Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
86.991exploits catalogados
40.452CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4.561Metasploit 3.537✓ só verificadosrecentespopularesrisco
86.991 exploits
Metasploit300
BMC TrackIt! Unauthenticated Arbitrary User Password Change
BMC Track-It! 11.3 allows remote attackers to gain privileges and execute arbitrary code by creating an account whose na
23RISCO
abrir ↗Metasploit600
Lexmark MarkVision Enterprise Arbitrary File Upload
Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allo
60RISCO
abrir ↗Exploit-DB
Advantech AdamView 4.30.003 - '.gni' Local Buffer Overflow (SEH)
Multiple stack-based buffer overflows in Advantech AdamView 4.3 and earlier allow remote attackers to execute arbitrary
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Kerberos - Privilege Escalation (MS14-068)
The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008
100RISCO
abrir ↗Exploit-DB
PBBoard CMS 3.0.1 - SQL Injection
SQL injection vulnerability in the CheckEmail function in includes/functions.class.php in PBBoard 3.0.1 before 20141128
23RISCO
abrir ↗Exploit-DB
Technicolor DT5130 2.05.C29GV - Multiple Vulnerabilities
Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to execute arbitrary commands via shell metac
23RISCO
abrir ↗Exploit-DB
Technicolor DT5130 2.05.C29GV - Multiple Vulnerabilities
Open redirect vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to redirect us
23RISCO
abrir ↗Exploit-DB
Technicolor DT5130 2.05.C29GV - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers t
23RISCO
abrir ↗Exploit-DB
Advertise With Pleasure! (AWP) 6.6 - SQL Injection
SQL injection vulnerability in Guruperl.net Advertise With Pleasure! Professional (aka AWP PRO) 6.6 and earlier allows r
23RISCO
abrir ↗Exploit-DB
WordPress Plugin Google Document Embedder 2.5.16 - 'mysql_real_escpae_string' Bypass SQL Injection
SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote atta
23RISCO
abrir ↗Exploit-DB
ManageEngine Netflow Analyzer / IT360 - Arbitrary File Download
Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 a
60RISCO
abrir ↗Exploit-DB
ManageEngine Netflow Analyzer / IT360 - Arbitrary File Download
Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2
35RISCO
abrir ↗Exploit-DB
WordPress Plugin Cart66 Lite eCommerce 1.5.1.17 - Blind SQL Injection
SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin be
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX - IOKit Keyboard Driver Privilege Escalation (Metasploit)
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitr
98RISCO
abrir ↗Exploit-DB
EntryPass N5200 - Credentials Exposure
EntryPass N5200 Active Network Control Panel does not properly restrict access, which allows remote attackers to obtain
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Tincd - (Authenticated) Remote TCP Stack Buffer Overflow (Metasploit)
Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pr
50RISCO
abrir ↗Exploit-DB
TYPO3 Extension ke DomPDF - Remote Code Execution
Unspecified vulnerability in the ke DomPDF extension before 0.0.5 for TYPO3 allows remote attackers to execute arbitrary
23RISCO
abrir ↗Metasploit600
ProjectSend Arbitrary File Upload
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows rem
50RISCO
abrir ↗Exploit-DB
EntryPass N5200 - Credentials Exposure
EntryPass N5200 Active Network Control Panel allows remote attackers to read device memory and obtain the administrator
23RISCO
abrir ↗Exploit-DB
WordPress Plugin Nextend Facebook Connect 1.4.59 - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before
23RISCO
abrir ↗Exploit-DB
tnftp (FreeBSD 8/9/10) - 'tnftp' Client Side
The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 thro
50RISCO
abrir ↗Exploit-DB
Thomson Reuters Fixed Assets CS 13.1.4 - Local Privilege Escalation
The installer in Thomson Reuters Fixed Assets CS 13.1.4 and earlier uses weak permissions for connectbgdl.exe, which all
23RISCO
abrir ↗Exploit-DB
ProjectSend r-561 - Arbitrary File Upload
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows rem
50RISCO
abrir ↗Exploit-DB
Drupal < 7.34 - Denial of Service
The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x
60RISCO
abrir ↗Exploit-DB
WordPress Core 4.0 - Denial of Service
wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 all
45RISCO
abrir ↗GitHub PoC★ 13
Python scripts to exploit CVE-2014-9016 and CVE-2014-9034
The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x
60RISCO
abrir ↗Exploit-DB
WordPress Core < 4.0.1 - Denial of Service
wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 all
45RISCO
abrir ↗Metasploit300
ManageEngine NetFlow Analyzer Arbitrary File Download
Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 a
60RISCO
abrir ↗GitHub PoC★ 5
app turn nil publics and privates into blanks 3 months ago config Use bundler/setup for more graceful bundler related failures 11 days ago data Add token fiddling from nishang 12 hours ago db Revert "Diff triggering comment" 12 days ago documentation Switch to Msf::OperatingSystems::Match::WINDOWS 2 months ago external Use PDWORD_PTR and DWORD_PTR 29 days ago features Up aruba timeout for simplecov overhead 4 days ago lib Check for load errors in reload_all 4 days ago modules Land #4255 - CVE-2014-6332 Internet Explorer 19 hours ago plugins Land #3588, @tobd-r7's Fix SpaceBeforeModifierKeyword Rubocop warning 4 months ago script rails generate cucumber:install 3 months ago scripts delete the old script a month ago spec Remove debug file writes 2 days ago test Fix up comment splats with the correct URI a month ago tools Fix bugs 24 days ago .gitignore Add note about rbenv for rvm .versions.conf local override 24 days ago .gitmodules Add RDI submodule, port Kitrap0d a year ago .mailmap Add @trosen-r7's alias for commits 6 months ago .rspec Add modern --require to .rspec 2 months ago .rubocop.yml Reapply PR #4113 (removed via #4175) 18 days ago .ruby-gemset Restoring ruby and gemset files 6 months ago .ruby-version Oh good, another Ruby version bump 14 days ago .simplecov Remove fastlib 2 months ago .travis.yml Enable fast_finish on travis-ci 12 days ago .yardopts Various merge resolutions from master <- staging 4 months ago CONTRIBUTING.md Add a don't to CONTRIBUTING about merge messages 11 days ago COPYING With 66 days left in 2014, may as well update a month ago Gemfile metasploit-credential bump to 0.13.3 16 days ago Gemfile.local.example Various merge resolutions from master <- staging 4 months ago Gemfile.lock Bump mdm version number 12 days ago HACKING Update link for The Metasploit Development Environment 5 months ago LICENSE Remove fastlib 2 months ago README.md Encourage use of the installer for users. 8 months ago Rakefile Merge branch 'feature/MSP-11130/metasploit-framework-spec-constants' … 24 days ago metasploit-framework-db.gemspec metasploit-credential bump to 0.13.3 16 days ago metasploit-framework-full.gemspec Update metasploit-framework-full.gemspec 23 days ago metasploit-framework-pcap.gemspec Depend on metasloit-framework in optional gemspecs 24 days ago metasploit-framework.gemspec Update meterpreter_bins to 0.0.11 18 days ago msfbinscan Remove fastlib 2 months ago msfcli Fix thread-leaks in msfcli spec 17 days ago msfconsole @wvu-r7 is a skilled negotiator. s/stdout/stderr/ a month ago msfd Remove fastlib 2 months ago msfelfscan Remove fastlib 2 months ago msfencode Remove fastlib 2 months ago msfmachscan Remove fastlib 2 months ago msfpayload fixes merge conflicts msfpayload & exe a month ago msfpescan Remove fastlib 2 months ago msfrop Remove fastlib 2 months ago msfrpc Remove fastlib 2 months ago msfrpcd Remove call to legacy db.sink queue, closes #4244 7 days ago msfupdate Always use maybe_wait_and_exit in msfupdate a year ago msfvenom Fix #4047 - undefined method `rank' due to an invalid encoder name 19 days ago README.md
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.